For the purposes of this discussion, I have a very current always-on linux machine with two nics:

  • wifi0
  • eth0

A very crude diagram of my desired configuration looks like this:

                               |    linux/main computer     |
                               |                            |
     ----------- /  ~ ~ ~ ~ ~ \ -------              -------|        
     | internet |-- ~ wifi ~ --| wifi0 |------------| eth0  |======)
     ----------- \  ~ ~ ~ ~ ~ / -------              -------|      |
                               |                            |      |
                               (----------------------------)      |
     \   subnet   /                                                |
      \  wifi    /                                                 |
      ------------                                                 |
      | dd-wrt   |=================================================)
      | router   |====\ subnet
      |          |====\ subnet

eth0 is connected to a router with a preconfigured firewalled gateway that I trust and is the nic from/to which I should prefer all general traffic flow.

The problem is that the firewalled gateway I trust is no longer a gateway; it has no internet connection.

Rather my internet access comes from wifi0. I wish to wall off wifi0, to forward all its traffic through to my trusted gateway over eth0, and to be able to maintain my own local subnet as managed by my router/gateway primarily on my router/gateway.

So basically I'm looking for a way to configure wifi0 to accept all incoming traffic and forward it immediately through eth0 to my router. I want all outgoing traffic not bound for my local subnet to be sent directly out over wifi0 to the wide-world, but all subnetted traffic to be handled by my local router, and all outgoing traffic - whether from my router or from my internet-connected computer to undergo nat and appear as if it originates from the same address.

It has to be possible, and I'd really like to do it just with iptables and/or the tools included with current iproute2 packages. My preference is networkd for nic init/setup, and I'm aware that I might need to bring up a virtual nic or two in the connected linux box to make it happen, but am fuzzy on details.

Will someone please help me with this? I'm very bad with packet filters and similar.

p.s. I'm hardly married to the title of this question and if someone can think of a more succinct/descriptive one I would be grateful.

If it makes any difference, I can also do:

-----        \   router   /
box  \        \ ________ /
---- |        /          \
eth0 [========] wan port |
---- |        |          |
eth1 [========] lan port [=======\subnet
____ /        \ ________ /

...because I do actually have two ethernet nics in my main box besides the wifi0 where the internet is sourced. So I supposed I could forward (or bridge?) all traffic between wifi0 and eth0 and for most intents and purposes ignore those two completely while routing all day-to-day traffic through eth1. I just really don't understand iptables or nftables or any of the rest well enough to effect my goal. Please give me a hand.

  • 1
    Let me check ... 1. you want inbound traffic to go straight from wifi0 through eth0 to your dd-wrt router, where it will be distributed according to subnet and routing table? 2. you want traffic from linux/main to go to the dd-wrt router, and thence back through linux/main eth0 and out through wifi0? 3. you don't want applications running on linux/main to be able to access wifi0 indiscriminantly, but only to see eth0? – roaima Sep 22 '15 at 14:37
  • @roaima - yeah, i think that's pretty much what i do want. – mikeserv Sep 22 '15 at 14:39
  • @roaima - ...???... – mikeserv Sep 22 '15 at 14:40
  • @roaima - you made this possible, huh? – mikeserv Aug 9 '16 at 10:11

This is necessarily not a guaranteed answer because I don't have the configuration you have described.


  1. All Internet-outbound traffic from managed subnet or Linux/Main computer ("LMC") to go directly out to the Internet via wlan0, using SNAT or MASQUERADE
  2. All Internet-inbound traffic that is part of the Internet-outbound traffic to be delivered directly, using the connection tracking created by the SNAT or MASQUERADE (above)
  3. All subnet-outbound traffic from LMC to go direct
  4. All unknown Internet-inbound traffic to be routed to the "trusted firewall" DD-WRT, which we'll assume is on

I believe we may be able to do this with iptables.

# Shortcuts
filter() { iptables -t filter "$@"; }
nat() { iptables -t nat "$@"; }

# Set the policy for INPUT and FORWARDING to DROP, OUTPUT to ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Empty all chains (erase all rules)
iptables -Z

# Enable forwarding
echo 1> net.ipv4.ip_forward

# SNAT outbound traffic on wlan0 (we will use MASQUERADE)

# Accept return traffic for our own outbound connections
filter -A INPUT -i wlan0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Forward all unknown inbound traffic to DD-WRT box, eg
nat -A PREROUTING -i wlan0 -j DNAT --to-destination

Now set up the routing tables so that your "LMC" knows how to reach DD-WRT, and in turn DD-WRT's default route is your "LMC". In fact, everything on your network should have "LMC" as its default route. The "LMC" itself should have your ISP upstream as its default route.

If you need specifics for this please provide some (example) IP addresses and gateways.

One word of warning: I'm not sure this is possible as described in your Question. You may need to NAT/route all traffic through DD-WRT (even outbound traffic from "LMC").

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.